From a815a566e2fb858f692eb15950fc538d45231e0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philipp=20Sch=C3=BCttl=C3=B6ffel?= Date: Mon, 17 Jun 2024 06:59:12 +0000 Subject: Resolve "Selbst hochgeladene Dateien in Ordnern ohne Lesezugriff schlecht sichtbar" Closes #2954 Merge request studip/studip!1997 --- .../JsonApi/Routes/Files/RangeFileRefsIndex.php | 2 +- .../JsonApi/Routes/Files/SubfilerefsIndex.php | 11 +++++++-- lib/classes/JsonApi/Schemas/File.php | 2 +- lib/classes/JsonApi/Schemas/Folder.php | 12 +++++++++- lib/filesystem/HomeworkFolder.php | 26 ++++++++++++++++++---- lib/filesystem/PermissionEnabledFolder.php | 23 ++++++++++++++++++- lib/filesystem/TimedFolder.php | 21 +++++++++++------ .../filesystem/homework_folder/description.php | 9 +------- templates/filesystem/timed_folder/description.php | 11 --------- 9 files changed, 81 insertions(+), 36 deletions(-) diff --git a/lib/classes/JsonApi/Routes/Files/RangeFileRefsIndex.php b/lib/classes/JsonApi/Routes/Files/RangeFileRefsIndex.php index 8f69d6a..773071e 100644 --- a/lib/classes/JsonApi/Routes/Files/RangeFileRefsIndex.php +++ b/lib/classes/JsonApi/Routes/Files/RangeFileRefsIndex.php @@ -13,7 +13,7 @@ class RangeFileRefsIndex extends AbstractRangeIndex $filerefs = []; foreach ($filesAndFolders['files'] as $file_object) { - if (method_exists($file_object, "getFileRef")) { + if (method_exists($file_object, 'getFileRef')) { $filerefs[] = $file_object->getFileRef(); } } diff --git a/lib/classes/JsonApi/Routes/Files/SubfilerefsIndex.php b/lib/classes/JsonApi/Routes/Files/SubfilerefsIndex.php index 0ff0603..2ed1a23 100644 --- a/lib/classes/JsonApi/Routes/Files/SubfilerefsIndex.php +++ b/lib/classes/JsonApi/Routes/Files/SubfilerefsIndex.php @@ -2,6 +2,7 @@ namespace JsonApi\Routes\Files; +use FileRef; use Psr\Http\Message\ServerRequestInterface as Request; use Psr\Http\Message\ResponseInterface as Response; use JsonApi\Errors\AuthorizationFailedException; @@ -28,8 +29,14 @@ class SubfilerefsIndex extends JsonApiController throw new AuthorizationFailedException(); } - $fileRefs = $folder->file_refs->getArrayCopy(); - list($offset, $limit) = $this->getOffsetAndLimit(); + $fileRefs = array_map( + function (\FileType $file): FileRef { + return $file->getFileRef(); + }, + $folder->getFiles() + ); + + [$offset, $limit] = $this->getOffsetAndLimit(); return $this->getPaginatedContentResponse( array_slice($fileRefs, $offset, $limit), diff --git a/lib/classes/JsonApi/Schemas/File.php b/lib/classes/JsonApi/Schemas/File.php index 8eb8046..df0263a 100644 --- a/lib/classes/JsonApi/Schemas/File.php +++ b/lib/classes/JsonApi/Schemas/File.php @@ -29,7 +29,7 @@ class File extends SchemaProvider 'chdate' => date('c', $resource['chdate']), ]; - if ($resource['metadata']['url']) { + if (!empty($resource['metadata']['url'])) { if (FilesAuthority::canUpdateFile($this->currentUser, $resource)) { $attributes['url'] = $resource['metadata']['url']; } diff --git a/lib/classes/JsonApi/Schemas/Folder.php b/lib/classes/JsonApi/Schemas/Folder.php index 2c61cae..4cb277e 100644 --- a/lib/classes/JsonApi/Schemas/Folder.php +++ b/lib/classes/JsonApi/Schemas/Folder.php @@ -169,14 +169,24 @@ class Folder extends SchemaProvider return $relationships; } + /** + * @param \FolderType $resource + */ private function getFilesRelationship(array $relationships, $resource) { + $fileRefs = array_map( + function (\FileType $file): \FileRef { + return $file->getFileRef(); + }, + $resource->getFiles() + ); + $relationships[self::REL_FILE_REFS] = [ self::RELATIONSHIP_LINKS => [ Link::RELATED => $this->getRelationshipRelatedLink($resource, self::REL_FILE_REFS), ], self::RELATIONSHIP_META => [ - 'count' => count($resource->file_refs) + 'count' => count($fileRefs), ], ]; diff --git a/lib/filesystem/HomeworkFolder.php b/lib/filesystem/HomeworkFolder.php index 70447fb..fb93ef8 100644 --- a/lib/filesystem/HomeworkFolder.php +++ b/lib/filesystem/HomeworkFolder.php @@ -82,10 +82,6 @@ class HomeworkFolder extends PermissionEnabledFolder $template = $GLOBALS['template_factory']->open('filesystem/homework_folder/description.php'); $template->folder = $this; $template->folderdata = $this->folderdata; - if (!Seminar_Perm::get()->have_studip_perm('tutor', $this->range_id)) { - $files = new SimpleCollection($this->getFiles()); - $template->own_files = $files->findBy('user_id', $GLOBALS['user']->id)->orderBy('name'); - } return $template; } @@ -101,6 +97,28 @@ class HomeworkFolder extends PermissionEnabledFolder } /** + * @param string $user_id + * @return bool + */ + public function isReadable($user_id = null) + { + return StandardFolder::isReadable($user_id); + } + + /** + * Determines if a user may see the file. + * @param FileRef|string $fileref_or_id + * @param string $user_id + * @return bool + */ + public function isFileVisible($fileref_or_id, $user_id) + { + $fileref = FileRef::toObject($fileref_or_id); + + return $fileref->user_id === $user_id || parent::isReadable($user_id); + } + + /** * @param FileRef|string $fileref_or_id * @param string $user_id * @return bool diff --git a/lib/filesystem/PermissionEnabledFolder.php b/lib/filesystem/PermissionEnabledFolder.php index d41ebe3..c286c53 100644 --- a/lib/filesystem/PermissionEnabledFolder.php +++ b/lib/filesystem/PermissionEnabledFolder.php @@ -118,6 +118,27 @@ class PermissionEnabledFolder extends StandardFolder } /** + * @return FileType[] + */ + public function getFiles() + { + return array_filter(parent::getFiles(), function($file) { + return $this->isFileVisible($file->getFileRef(), $GLOBALS['user']->id); + }); + } + + /** + * Determines if a user may see the file. + * @param FileRef|string $fileref_or_id + * @param string $user_id + * @return bool + */ + public function isFileVisible($fileref_or_id, $user_id) + { + return $this->isReadable($user_id); + } + + /** * @param $fileref_or_id * @param $user_id * @return bool @@ -127,7 +148,7 @@ class PermissionEnabledFolder extends StandardFolder $fileref = FileRef::toObject($fileref_or_id); if (is_object($fileref)) { - if ($this->isVisible($user_id) && $this->isReadable($user_id)) { + if ($this->isVisible($user_id) && $this->isFileVisible($fileref, $user_id)) { return $fileref->terms_of_use->isDownloadable($this->range_id, $this->range_type, true, $user_id); } } diff --git a/lib/filesystem/TimedFolder.php b/lib/filesystem/TimedFolder.php index d5f933b..0c159d6 100644 --- a/lib/filesystem/TimedFolder.php +++ b/lib/filesystem/TimedFolder.php @@ -81,7 +81,7 @@ class TimedFolder extends PermissionEnabledFolder ($this->end_time == 0 || $this->end_time >= $now) || $GLOBALS['perm']->have_studip_perm($this->must_have_perm, $this->range_id, $user_id)) && - parent::isReadable($user_id); + StandardFolder::isReadable($user_id); } public function isWritable($user_id = null) @@ -96,6 +96,19 @@ class TimedFolder extends PermissionEnabledFolder } /** + * Determines if a user may see the file. + * @param FileRef|string $fileref_or_id + * @param string $user_id + * @return bool + */ + public function isFileVisible($fileref_or_id, $user_id) + { + $fileref = FileRef::toObject($fileref_or_id); + + return $fileref->user_id === $user_id || parent::isReadable($user_id); + } + + /** * This function returns the suitable Icon for this folder type (TimedFolder) * * @return Icon The icon object for this folder type @@ -143,12 +156,6 @@ class TimedFolder extends PermissionEnabledFolder $template->folder = $this; $template->folderdata = $this->folderdata; - if (!Seminar_Perm::get()->have_studip_perm('tutor', $this->range_id) && - $this->isWritable($GLOBALS['user']->id) && !$this->isReadable($GLOBALS['user']->id)) { - $files = new SimpleCollection($this->getFiles()); - $template->own_files = $files->findBy('user_id', $GLOBALS['user']->id)->orderBy('name'); - } - return $template; } diff --git a/templates/filesystem/homework_folder/description.php b/templates/filesystem/homework_folder/description.php index b3bc7f1..c47d6b0 100644 --- a/templates/filesystem/homework_folder/description.php +++ b/templates/filesystem/homework_folder/description.php @@ -1,14 +1,7 @@
- 0) : ?> - - - +
diff --git a/templates/filesystem/timed_folder/description.php b/templates/filesystem/timed_folder/description.php index ae5bd9e..396a286 100644 --- a/templates/filesystem/timed_folder/description.php +++ b/templates/filesystem/timed_folder/description.php @@ -36,17 +36,6 @@
- 0) : ?> -
- - -
- -
-- cgit v1.0